@nocobase/app-plugin-agents 1.0.0-beta.16 → 1.0.0-beta.18

package/dist/server/online/sandbox/provider.d.ts

@@ -0,0 +1,9 @@
+import type { SkillService } from '../../core/skills/skill.service.js';
+import type { OnlineAgentSandboxProvider, OnlineAgentSandboxOptions } from './types.js';
+type SandboxDependencies = OnlineAgentSandboxOptions & {
+    skills: SkillService;
+};
+/** Prepare Skills without credentials; own the CLI lease only while a Sandbox exists. */
+export declare function createSandboxProvider(deps: SandboxDependencies): OnlineAgentSandboxProvider;
+export {};
+//# sourceMappingURL=provider.d.ts.map

package/dist/server/online/sandbox/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../../server/online/sandbox/provider.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,KAAK,EACV,0BAA0B,EAK1B,yBAAyB,EAC1B,MAAM,YAAY,CAAC;AAMpB,KAAK,mBAAmB,GAAG,yBAAyB,GAAG;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC;AAMhF,yFAAyF;AACzF,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,mBAAmB,GACxB,0BAA0B,CAI5B"}

package/dist/server/online/sandbox/provider.js

@@ -0,0 +1,237 @@
+import { randomUUID } from 'node:crypto';
+import { HEADERS } from '@nocobase/agent-protocol';
+import { callerIdentityOf } from '../../cli/run-credential.js';
+import { Bash, getCommandNames, } from '../../vendor/just-bash.js';
+import { createSandboxFilesystem } from './filesystem.js';
+import { loadSkills } from './skills.js';
+import { cliCommand } from './cli-command.js';
+import { sandboxLimits, clip } from './limits.js';
+/** Prepare Skills without credentials; own the CLI lease only while a Sandbox exists. */
+export function createSandboxProvider(deps) {
+    return {
+        prepare: (input) => prepareSandbox(deps, input),
+    };
+}
+async function prepareSandbox(deps, input) {
+    input.context.signal.throwIfAborted();
+    const loaded = await loadSkills(deps.skills, input.skill, deps.builtinSkills);
+    return new PreparedSandbox(deps, input, loaded);
+}
+/** The selected Skill snapshot exists before any filesystem, CLI or credential is allocated. */
+class PreparedSandbox {
+    deps;
+    input;
+    loaded;
+    instructions;
+    released = false;
+    constructor(deps, input, loaded) {
+        this.deps = deps;
+        this.input = input;
+        this.loaded = loaded;
+        this.instructions = this.sandboxInstructions(deps.bin?.());
+    }
+    sandboxInstructions(bin) {
+        return [
+            'Virtual shell: /tmp is the only writable directory; /skills is read-only. No host files, environment, network or external runtimes.',
+            bin
+                ? 'Application CLI: ' +
+                    bin +
+                    '. Use --help to discover current commands. Authorization and business rules apply; never retry an uncertain write without checking its result.'
+                : 'No application CLI is configured.',
+            'Selected skills (read with skill or cat only when needed):',
+            ...[...this.loaded.skills].map(([slug, skill]) => slug + ': ' + skill.description + ' (/skills/' + slug + '/SKILL.md)'),
+        ].join('\n');
+    }
+    readSkill(name) {
+        if (this.released)
+            return Promise.reject(new Error('Execution is closed.'));
+        this.input.context.signal.throwIfAborted();
+        const skill = this.loaded.skills.get(name);
+        return Promise.resolve({
+            ok: !!skill,
+            output: skill
+                ? clip([skill.markdown, 'Support files:', ...skill.listing].join('\n'))
+                : 'Unknown selected skill.',
+        });
+    }
+    async create() {
+        if (this.released)
+            throw new Error('Execution is closed.');
+        this.input.context.signal.throwIfAborted();
+        const filesystem = createSandboxFilesystem(this.loaded.files, undefined, this.loaded.unreadable);
+        // InMemoryFs owns the mounted storage; do not retain a second file map.
+        this.clearFiles();
+        return createSandbox(this, this.deps, this.input, filesystem);
+    }
+    close() {
+        this.released = true;
+    }
+    dispose() {
+        this.close();
+        this.loaded.skills.clear();
+        this.clearFiles();
+    }
+    clearFiles() {
+        for (const path of Object.keys(this.loaded.files))
+            delete this.loaded.files[path];
+    }
+}
+/** Creation owns partial-resource cleanup, including failures before a shell is returned. */
+async function createSandbox(preparation, deps, input, filesystem) {
+    let lease;
+    try {
+        const application = deps.cli?.();
+        let surface;
+        if (application) {
+            lease = application.credentials.issue(input.context.user.id, input.executionId ?? randomUUID());
+            surface = await loadCommandSurface(application, lease.token);
+        }
+        return new SandboxExecution(preparation, input, filesystem, surface, lease);
+    }
+    catch (error) {
+        try {
+            await filesystem.dispose();
+        }
+        finally {
+            lease?.release();
+        }
+        throw error;
+    }
+}
+async function loadCommandSurface(application, token) {
+    const session = await application.auth.getSession(new Headers({ [HEADERS.runToken]: token }));
+    const identity = callerIdentityOf(session ?? undefined);
+    if (!identity)
+        throw new Error('OnlineAgent caller is unavailable.');
+    const surface = await application.commandsOf(identity, token);
+    if (surface && !/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/u.test(surface.bin))
+        throw new Error('Invalid application CLI brand.');
+    return surface;
+}
+function createBash(filesystem, command) {
+    return new Bash({
+        fs: filesystem.fs,
+        cwd: '/tmp',
+        env: { HOME: '/tmp' },
+        executionLimitProfile: 'hardened',
+        commands: getCommandNames().filter((name) => name !== 'sqlite3'),
+        python: false,
+        javascript: false,
+        customCommands: command ? [command] : [],
+        executionLimits: {
+            maxOutputSize: sandboxLimits.shellOutput,
+            maxExecutionTimeMs: sandboxLimits.durationMs,
+        },
+    });
+}
+function shellResult(result) {
+    return {
+        ok: result.exitCode === 0,
+        output: clip([
+            'exit code ' + result.exitCode,
+            result.stdout ? result.stdout.replace(/\n$/u, '') : '',
+            result.stderr ? '[stderr]\n' + result.stderr.replace(/\n$/u, '') : '',
+        ]
+            .filter(Boolean)
+            .join('\n')),
+        exitCode: result.exitCode,
+    };
+}
+/** Own serialized shell calls, real CLI work and retryable cleanup for one execution. */
+class SandboxExecution {
+    preparation;
+    input;
+    filesystem;
+    lease;
+    instructions;
+    bash;
+    abort = new AbortController();
+    work = new Set();
+    queue = Promise.resolve();
+    cleanup;
+    closed = false;
+    constructor(preparation, input, filesystem, surface, lease) {
+        this.preparation = preparation;
+        this.input = input;
+        this.filesystem = filesystem;
+        this.lease = lease;
+        const cli = surface ? cliCommand(surface, input.context.signal) : undefined;
+        this.bash = createBash(filesystem, cli ? this.trackCommand(cli) : undefined);
+        filesystem.lock();
+        this.instructions = preparation.sandboxInstructions(surface?.bin);
+    }
+    trackCommand(command) {
+        return {
+            ...command,
+            execute: (args, ctx) => {
+                // Bash can detach a cancelled command; keep owning its actual application work.
+                const task = command.execute(args, ctx);
+                this.work.add(task);
+                void task.finally(() => this.work.delete(task)).catch(() => { });
+                return task;
+            },
+        };
+    }
+    exec(command, options) {
+        if (this.closed)
+            return Promise.reject(new Error('Sandbox is closed.'));
+        // The deadline includes time spent waiting in the queue.
+        const deadline = AbortSignal.timeout(sandboxLimits.durationMs);
+        const signal = AbortSignal.any([
+            this.input.context.signal,
+            this.abort.signal,
+            deadline,
+            ...(options.abortSignal ? [options.abortSignal] : []),
+        ]);
+        const task = this.queue
+            .catch(() => { })
+            .then(() => this.run(command, signal));
+        this.queue = task;
+        return task;
+    }
+    async run(command, signal) {
+        signal.throwIfAborted();
+        try {
+            return shellResult(await this.bash.exec(command, { signal }));
+        }
+        catch (error) {
+            signal.throwIfAborted();
+            return {
+                ok: false,
+                output: clip(error instanceof Error ? error.message : 'Virtual shell failed.'),
+                exitCode: 1,
+            };
+        }
+        finally {
+            // Cancellation must not release the execution gate before real CLI work exits.
+            await Promise.allSettled([...this.work]);
+            signal.throwIfAborted();
+        }
+    }
+    readSkill(name) {
+        if (this.closed)
+            return Promise.reject(new Error('Sandbox is closed.'));
+        return this.preparation.readSkill(name);
+    }
+    dispose() {
+        if (this.cleanup)
+            return this.cleanup;
+        this.closed = true;
+        this.preparation.close();
+        this.abort.abort();
+        this.cleanup = this.releaseResources().catch((error) => {
+            // A failed cleanup is retryable, but never reopens this execution.
+            this.cleanup = undefined;
+            throw error;
+        });
+        return this.cleanup;
+    }
+    async releaseResources() {
+        await this.queue.catch(() => { });
+        await Promise.allSettled([...this.work]);
+        await this.filesystem.dispose();
+        this.preparation.dispose();
+        this.lease?.release();
+    }
+}
+//# sourceMappingURL=provider.js.map

package/dist/server/online/sandbox/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../../../server/online/sandbox/provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAEnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EACL,IAAI,EACJ,eAAe,GAIhB,MAAM,2BAA2B,CAAC;AAUnC,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAQlD,yFAAyF;AACzF,MAAM,UAAU,qBAAqB,CACnC,IAAyB;IAEzB,OAAO;QACL,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,IAAyB,EACzB,KAA8B;IAE9B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IAC9E,OAAO,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,gGAAgG;AAChG,MAAM,eAAe;IAKA;IACA;IACA;IANV,YAAY,CAAS;IACtB,QAAQ,GAAG,KAAK,CAAC;IAEzB,YACmB,IAAyB,EACzB,KAA8B,EAC9B,MAAsB;QAFtB,SAAI,GAAJ,IAAI,CAAqB;QACzB,UAAK,GAAL,KAAK,CAAyB;QAC9B,WAAM,GAAN,MAAM,CAAgB;QAEvC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,mBAAmB,CAAC,GAAY;QAC9B,OAAO;YACL,qIAAqI;YACrI,GAAG;gBACD,CAAC,CAAC,mBAAmB;oBACnB,GAAG;oBACH,gJAAgJ;gBAClJ,CAAC,CAAC,mCAAmC;YACvC,4DAA4D;YAC5D,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAC5B,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAChB,IAAI,GAAG,IAAI,GAAG,KAAK,CAAC,WAAW,GAAG,YAAY,GAAG,IAAI,GAAG,YAAY,CACvE;SACF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IAED,SAAS,CAAC,IAAY;QACpB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,EAAE,EAAE,CAAC,CAAC,KAAK;YACX,MAAM,EAAE,KAAK;gBACX,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACvE,CAAC,CAAC,yBAAyB;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,uBAAuB,CACxC,IAAI,CAAC,MAAM,CAAC,KAAK,EACjB,SAAS,EACT,IAAI,CAAC,MAAM,CAAC,UAAU,CACvB,CAAC;QACF,wEAAwE;QACxE,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAChE,CAAC;IAED,KAAK;QACH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;IAED,OAAO;QACL,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;IAEO,UAAU;QAChB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;CACF;AAED,6FAA6F;AAC7F,KAAK,UAAU,aAAa,CAC1B,WAA4B,EAC5B,IAAyB,EACzB,KAA8B,EAC9B,UAA6B;IAE7B,IAAI,KAAkC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACjC,IAAI,OAAmC,CAAC;QACxC,IAAI,WAAW,EAAE,CAAC;YAChB,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CACnC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EACrB,KAAK,CAAC,WAAW,IAAI,UAAU,EAAE,CAClC,CAAC;YACF,OAAO,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,IAAI,gBAAgB,CAAC,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC;QAC7B,CAAC;gBAAS,CAAC;YACT,KAAK,EAAE,OAAO,EAAE,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,WAAsE,EACtE,KAAa;IAEb,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,CAC/C,IAAI,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAC3C,CAAC;IACF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC9D,IAAI,OAAO,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,UAA6B,EAAE,OAAiB;IAClE,OAAO,IAAI,IAAI,CAAC;QACd,EAAE,EAAE,UAAU,CAAC,EAAE;QACjB,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACrB,qBAAqB,EAAE,UAAU;QACjC,QAAQ,EAAE,eAAe,EAAE,CAAC,MAAM,CAChC,CAAC,IAAI,EAAuB,EAAE,CAAC,IAAI,KAAK,SAAS,CAClD;QACD,MAAM,EAAE,KAAK;QACb,UAAU,EAAE,KAAK;QACjB,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;QACxC,eAAe,EAAE;YACf,aAAa,EAAE,aAAa,CAAC,WAAW;YACxC,kBAAkB,EAAE,aAAa,CAAC,UAAU;SAC7C;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAAkB;IACrC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC;QACzB,MAAM,EAAE,IAAI,CACV;YACE,YAAY,GAAG,MAAM,CAAC,QAAQ;YAC9B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;YACtD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;SACtE;aACE,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,IAAI,CAAC,CACd;QACD,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,MAAM,gBAAgB;IAUD;IACA;IACA;IAEA;IAbV,YAAY,CAAS;IACb,IAAI,CAAO;IACX,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;IAC9B,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC5C,KAAK,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC5C,OAAO,CAA4B;IACnC,MAAM,GAAG,KAAK,CAAC;IAEvB,YACmB,WAA4B,EAC5B,KAA8B,EAC9B,UAA6B,EAC9C,OAAwB,EACP,KAAuB;QAJvB,gBAAW,GAAX,WAAW,CAAiB;QAC5B,UAAK,GAAL,KAAK,CAAyB;QAC9B,eAAU,GAAV,UAAU,CAAmB;QAE7B,UAAK,GAAL,KAAK,CAAkB;QAExC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,UAAU,CACpB,UAAU,EACV,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CACzC,CAAC;QACF,UAAU,CAAC,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;IAEO,YAAY,CAAC,OAAgB;QACnC,OAAO;YACL,GAAG,OAAO;YACV,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;gBACrB,gFAAgF;gBAChF,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACxC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACpB,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAChE,OAAO,IAAI,CAAC;YACd,CAAC;SACF,CAAC;IACJ,CAAC;IAED,IAAI,CACF,OAAe,EACf,OAAkD;QAElD,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACxE,yDAAyD;QACzD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC;YAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM;YACzB,IAAI,CAAC,KAAK,CAAC,MAAM;YACjB,QAAQ;YACR,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK;aACpB,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;aACf,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,GAAG,CACf,OAAe,EACf,MAAmB;QAEnB,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,WAAW,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,IAAI,CACV,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CACjE;gBACD,QAAQ,EAAE,CAAC;aACZ,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,+EAA+E;YAC/E,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACzC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,SAAS,CAAC,IAAY;QACpB,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO;QACL,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC9D,mEAAmE;YACnE,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;YACzB,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACjC,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAChC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;IACxB,CAAC;CACF"}

package/dist/server/online/sandbox/skills.d.ts

@@ -0,0 +1,14 @@
+import type { SkillService } from '../../core/skills/skill.service.js';
+import type { OnlineAgentSandboxSkillCatalog } from './types.js';
+/** Read current resources once per SDK segment; no resource versions survive preparation. */
+export declare function loadSkills(service: SkillService, ids: readonly string[], builtinSkills?: OnlineAgentSandboxSkillCatalog): Promise<{
+    skills: Map<string, {
+        name: string;
+        description: string;
+        markdown: string;
+        listing: string[];
+    }>;
+    files: Record<string, string>;
+    unreadable: Map<string, string>;
+}>;
+//# sourceMappingURL=skills.d.ts.map

package/dist/server/online/sandbox/skills.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../../../server/online/sandbox/skills.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAEvE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAGjE,6FAA6F;AAC7F,wBAAsB,UAAU,CAC9B,OAAO,EAAE,YAAY,EACrB,GAAG,EAAE,SAAS,MAAM,EAAE,EACtB,aAAa,CAAC,EAAE,8BAA8B,GAC7C,OAAO,CAAC;IACT,MAAM,EAAE,GAAG,CACT,MAAM,EACN;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAC3E,CAAC;IACF,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC,CAAC,CA4DD"}

package/dist/server/online/sandbox/skills.js

@@ -0,0 +1,56 @@
+import { skillFilePathProblem } from '../../../shared/skills.js';
+import { sandboxLimits } from './limits.js';
+/** Read current resources once per SDK segment; no resource versions survive preparation. */
+export async function loadSkills(service, ids, builtinSkills) {
+    const skills = new Map();
+    const files = {};
+    const unreadable = new Map();
+    let bytes = 0;
+    const selected = [];
+    for (const id of ids) {
+        // Selection is a trusted server scope. SkillService has no per-user read/enable policy.
+        const builtin = builtinSkills?.get(id);
+        const current = builtin ? await builtin() : await service.get(id);
+        if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/u.test(current.slug) ||
+            skills.has(current.slug))
+            throw new Error('Invalid or duplicate selected skill slug.');
+        bytes += Buffer.byteLength(current.content);
+        if (bytes > sandboxLimits.skillBytes)
+            throw new Error('Selected skill entry exceeds mount budget.');
+        skills.set(current.slug, {
+            name: current.name,
+            description: current.description,
+            markdown: current.content,
+            listing: [],
+        });
+        files['/skills/' + current.slug + '/SKILL.md'] = current.content;
+        selected.push(current);
+    }
+    // Reserve all entry documents before admitting supporting text in stable path order.
+    for (const current of selected) {
+        const paths = new Set();
+        for (const file of [...current.files].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0)) {
+            if (skillFilePathProblem(file.path) || paths.has(file.path))
+                throw new Error('Invalid or duplicate skill support path.');
+            paths.add(file.path);
+            const path = '/skills/' + current.slug + '/' + file.path;
+            const size = file.content === null ? 0 : Buffer.byteLength(file.content);
+            const reason = file.content === null
+                ? 'Binary skill file is not readable.'
+                : bytes + size > sandboxLimits.skillBytes
+                    ? 'Skill file exceeds mount budget.'
+                    : undefined;
+            skills
+                .get(current.slug)
+                .listing.push(file.path + (reason ? ' [unreadable: ' + reason + ']' : ''));
+            if (reason)
+                unreadable.set(path, reason);
+            else {
+                files[path] = file.content;
+                bytes += size;
+            }
+        }
+    }
+    return { skills, files, unreadable };
+}
+//# sourceMappingURL=skills.js.map

package/dist/server/online/sandbox/skills.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.js","sourceRoot":"","sources":["../../../../server/online/sandbox/skills.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAqB,EACrB,GAAsB,EACtB,aAA8C;IAS9C,MAAM,MAAM,GAAG,IAAI,GAAG,EAGnB,CAAC;IACJ,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,QAAQ,GAAG,EAAE,CAAC;IACpB,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,wFAAwF;QACxF,MAAM,OAAO,GAAG,aAAa,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClE,IACE,CAAC,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YACjD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;YAExB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,GAAG,aAAa,CAAC,UAAU;YAClC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE;YACvB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,OAAO;YACzB,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC;QACH,KAAK,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,GAAG,WAAW,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;QACjE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IACD,qFAAqF;IACrF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAClD,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC/C,EAAE,CAAC;YACF,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBACzD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC9D,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,MAAM,IAAI,GAAG,UAAU,GAAG,OAAO,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC;YACzD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzE,MAAM,MAAM,GACV,IAAI,CAAC,OAAO,KAAK,IAAI;gBACnB,CAAC,CAAC,oCAAoC;gBACtC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,aAAa,CAAC,UAAU;oBACvC,CAAC,CAAC,kCAAkC;oBACpC,CAAC,CAAC,SAAS,CAAC;YAClB,MAAM;iBACH,GAAG,CAAC,OAAO,CAAC,IAAI,CAAE;iBAClB,OAAO,CAAC,IAAI,CACX,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,GAAG,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAC5D,CAAC;YACJ,IAAI,MAAM;gBAAE,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;iBACpC,CAAC;gBACJ,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAQ,CAAC;gBAC5B,KAAK,IAAI,IAAI,CAAC;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AACvC,CAAC"}

package/dist/server/online/sandbox/tools.d.ts

@@ -0,0 +1,3 @@
+import type { OnlineAgentConfigurator } from '../agent/configuration.js';
+export declare function registerSandboxTools(configurator: OnlineAgentConfigurator): void;
+//# sourceMappingURL=tools.d.ts.map

package/dist/server/online/sandbox/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../../../server/online/sandbox/tools.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAIzE,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,uBAAuB,GACpC,IAAI,CA8BN"}

package/dist/server/online/sandbox/tools.js

@@ -0,0 +1,35 @@
+import { z } from 'zod';
+import { sandboxLimits } from './limits.js';
+const registered = new WeakSet();
+export function registerSandboxTools(configurator) {
+    if (registered.has(configurator))
+        return;
+    configurator.registerTool('bash', {
+        version: '1',
+        definition: {
+            description: [
+                'Run a shell command in your sandbox (bash syntax; ls, cat, grep, find, sed, awk, jq and the like).',
+                'When configured, reach the application with its command line (named in the sandbox instructions); use --help to discover current commands.',
+                'Your selected skills are at /skills/<name>/, read-only.',
+                `Write scratch files under /tmp only. No network; nothing is installed or run for real, so a skill's scripts cannot be executed. Each command stops after ${sandboxLimits.durationMs / 1000} seconds.`,
+            ].join(' '),
+            inputSchema: z.object({ command: z.string() }),
+            async execute({ command }, options) {
+                const sandbox = await options.context.execution.getSandbox();
+                return sandbox.exec(command, options);
+            },
+            toModelOutput: ({ output }) => ({ type: 'json', value: output }),
+        },
+    });
+    configurator.registerTool('skill', {
+        version: '1',
+        definition: {
+            description: 'Read one of your skills: its SKILL.md and the list of its files, which you read with the bash tool. Read a skill when its description matches what you are doing, and follow it.',
+            inputSchema: z.object({ name: z.string() }),
+            execute: ({ name }, options) => options.context.execution.readSkill(name),
+            toModelOutput: ({ output }) => ({ type: 'json', value: output }),
+        },
+    });
+    registered.add(configurator);
+}
+//# sourceMappingURL=tools.js.map

package/dist/server/online/sandbox/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../../../server/online/sandbox/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,UAAU,GAAG,IAAI,OAAO,EAA2B,CAAC;AAC1D,MAAM,UAAU,oBAAoB,CAClC,YAAqC;IAErC,IAAI,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO;IACzC,YAAY,CAAC,YAAY,CAAC,MAAM,EAAE;QAChC,OAAO,EAAE,GAAG;QACZ,UAAU,EAAE;YACV,WAAW,EAAE;gBACX,oGAAoG;gBACpG,4IAA4I;gBAC5I,yDAAyD;gBACzD,4JAA4J,aAAa,CAAC,UAAU,GAAG,IAAI,WAAW;aACvM,CAAC,IAAI,CAAC,GAAG,CAAC;YACX,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO;gBAChC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;gBAC7D,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACxC,CAAC;YACD,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;SACjE;KACF,CAAC,CAAC;IACH,YAAY,CAAC,YAAY,CAAC,OAAO,EAAE;QACjC,OAAO,EAAE,GAAG;QACZ,UAAU,EAAE;YACV,WAAW,EACT,kLAAkL;YACpL,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC;YACzE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;SACjE;KACF,CAAC,CAAC;IACH,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AAC/B,CAAC"}

package/dist/server/online/sandbox/types.d.ts

@@ -0,0 +1,72 @@
+import type { Auth } from '@nocobase/app-plugin-authentication';
+import type { OnlineAgentCredentials } from '../../cli/online-credential.js';
+import type { CallerIdentity } from '../../core/callers/index.js';
+import type { OnlineAgentToolContext } from '../agent/types.js';
+import type { CliCommand } from '@nocobase/app-cli-client/parse';
+/** Application dependencies; the CLI is resolved only when a Sandbox is actually created. */
+export interface OnlineAgentSandboxOptions {
+    builtinSkills?: OnlineAgentSandboxSkillCatalog;
+    bin?: () => string | undefined;
+    cli?: () => {
+        auth: Auth;
+        credentials: OnlineAgentCredentials;
+        commandsOf(identity: CallerIdentity, token: string): Promise<CommandSurface | undefined>;
+    };
+}
+/** Current application-owned Skill resources, loaded anew for every SDK execution segment. */
+export interface OnlineAgentSandboxSkill {
+    readonly slug: string;
+    readonly name: string;
+    readonly description: string;
+    readonly content: string;
+    readonly files: readonly {
+        readonly path: string;
+        readonly content: string | null;
+    }[];
+}
+export type OnlineAgentSandboxSkillCatalog = ReadonlyMap<string, () => Promise<OnlineAgentSandboxSkill>>;
+export type OnlineAgentSandboxInput = {
+    sessionId: string;
+    executionId?: string;
+    context: Omit<OnlineAgentToolContext, 'execution'>;
+    skill: readonly string[];
+};
+export interface OnlineAgentSandbox {
+    readonly instructions: string;
+    exec(command: string, options: {
+        toolCallId: string;
+        abortSignal?: AbortSignal;
+    }): Promise<{
+        ok: boolean;
+        output: string;
+        exitCode: number;
+    }>;
+    readSkill(name: string): Promise<{
+        ok: boolean;
+        output: string;
+    }>;
+    dispose(): Promise<void>;
+}
+export interface OnlineAgentSandboxPreparation {
+    readonly instructions: string;
+    readSkill(name: string): Promise<{
+        ok: boolean;
+        output: string;
+    }>;
+    create(): Promise<OnlineAgentSandbox>;
+    dispose(): void;
+}
+export interface OnlineAgentSandboxProvider {
+    prepare(input: OnlineAgentSandboxInput): Promise<OnlineAgentSandboxPreparation>;
+}
+/** Caller-filtered application commands and authenticated, application-local dispatch. */
+export interface CommandSurface {
+    readonly bin: string;
+    readonly commands: readonly CliCommand[];
+    send(request: {
+        readonly method: string;
+        readonly path: string;
+        readonly body?: string | FormData;
+    }, signal?: AbortSignal): Promise<Response>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/server/online/sandbox/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../server/online/sandbox/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,qCAAqC,CAAC;AAChE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAEjE,6FAA6F;AAC7F,MAAM,WAAW,yBAAyB;IACxC,aAAa,CAAC,EAAE,8BAA8B,CAAC;IAC/C,GAAG,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM;QACV,IAAI,EAAE,IAAI,CAAC;QACX,WAAW,EAAE,sBAAsB,CAAC;QACpC,UAAU,CACR,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;KACxC,CAAC;CACH;AAED,8FAA8F;AAC9F,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;KACjC,EAAE,CAAC;CACL;AACD,MAAM,MAAM,8BAA8B,GAAG,WAAW,CACtD,MAAM,EACN,MAAM,OAAO,CAAC,uBAAuB,CAAC,CACvC,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,IAAI,CAAC,sBAAsB,EAAE,WAAW,CAAC,CAAC;IACnD,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B,CAAC;AACF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,IAAI,CACF,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,WAAW,CAAA;KAAE,GACzD,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AACD,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,MAAM,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACtC,OAAO,IAAI,IAAI,CAAC;CACjB;AACD,MAAM,WAAW,0BAA0B;IACzC,OAAO,CACL,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,6BAA6B,CAAC,CAAC;CAC3C;AACD,0FAA0F;AAC1F,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,SAAS,UAAU,EAAE,CAAC;IACzC,IAAI,CACF,OAAO,EAAE;QACP,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;KACnC,EACD,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,QAAQ,CAAC,CAAC;CACtB"}

package/dist/server/online/sandbox/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/server/online/sandbox/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../server/online/sandbox/types.ts"],"names":[],"mappings":""}

package/dist/server/providers/agents.d.ts

@@ -4,12 +4,12 @@ import type { OnlineAgentRecoveryConfig } from '../online/agent/types.js';
  * conversations, and the vector queue's worker. The runners' side (their announcements, the sweeper and the wake-ups of
  * work sent back with a back-off) is `runners.ts`.
  */
-import type { RunApp } from '@nocobase/agent-protocol';
+import { type RunApp } from '@nocobase/agent-protocol';
 import type { AppPluginApplication } from '@nocobase/app-server/plugins';
 import { ServiceProvider } from '@nocobase/service-provider';
 import type { VectorsConfig } from '../vectors/index.js';
 import type { DistConfig } from '../distribution/index.js';
-import type { AgentCli } from '../core/runs/index.js';
+import { type AgentCli } from '../core/runs/index.js';
 /** `agents` in the application's configuration. */
 export interface AgentsConfig {
     readonly uiRecovery?: OnlineAgentRecoveryConfig;
@@ -57,6 +57,9 @@ export declare class AgentsProvider extends ServiceProvider<AppPluginApplication
     readonly name: string;
     private readonly releases;
     private stoppingVectors;
+    private surface;
+    /** Historical command surface, with execution-local authentication and cancellation. */
+    private commandsOf;
     register(): void;
     /** How runners name this application: `agents.app`, else the CLI's name, else the application's. */
     private runApp;

package/dist/server/providers/agents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../../server/providers/agents.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAE1E;;;;GAIG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAMvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAQzE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAa7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAMtD,mDAAmD;AACnD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,yBAAyB,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE;QACd,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;KACpC,CAAC;IACF,yFAAyF;IACzF,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC,oGAAoG;IACpG,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAMD,qBAAa,cAAe,SAAQ,eAAe,CAAC,oBAAoB,CAAC;IACvE,SAAgB,IAAI,EAAE,MAAM,CAAoB;IAChD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsB;IAC/C,OAAO,CAAC,eAAe,CAA4B;IAEnC,QAAQ,IAAI,IAAI;IAsEhC,oGAAoG;IACpG,OAAO,CAAC,MAAM;IAMd,gGAAgG;IAChG,OAAO,CAAC,qBAAqB;IAUP,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAwB3C,iGAAiG;IACjG,OAAO,CAAC,cAAc;IAgBtB;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAqBJ,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAY/C,kGAAkG;IAClG,OAAO,CAAC,QAAQ;CA0HjB"}
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../../server/providers/agents.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAE1E;;;;GAIG;AACH,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAMhE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAQzE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAa7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAmB,KAAK,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAYvE,mDAAmD;AACnD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,yBAAyB,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE;QACd,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;KACpC,CAAC;IACF,yFAAyF;IACzF,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC,oGAAoG;IACpG,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAMD,qBAAa,cAAe,SAAQ,eAAe,CAAC,oBAAoB,CAAC;IACvE,SAAgB,IAAI,EAAE,MAAM,CAAoB;IAChD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsB;IAC/C,OAAO,CAAC,eAAe,CAA4B;IACnD,OAAO,CAAC,OAAO,CAAyB;IAExC,wFAAwF;IACxF,OAAO,CAAC,UAAU;IA6CF,QAAQ,IAAI,IAAI;IAqFhC,oGAAoG;IACpG,OAAO,CAAC,MAAM;IAMd,gGAAgG;IAChG,OAAO,CAAC,qBAAqB;IAUP,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAwB3C,iGAAiG;IACjG,OAAO,CAAC,cAAc;IAgBtB;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IA4BJ,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAY/C,kGAAkG;IAClG,OAAO,CAAC,QAAQ;CA0HjB"}

package/dist/server/providers/agents.js

@@ -1,4 +1,10 @@
 import { mayAccessRun } from '../core/runs/access.js';
+/**
+ * Binds the plugin's services, and at boot connects them to the platform: realtime announcements of runs and
+ * conversations, and the vector queue's worker. The runners' side (their announcements, the sweeper and the wake-ups of
+ * work sent back with a back-off) is `runners.ts`.
+ */
+import { HEADERS } from '@nocobase/agent-protocol';
 import { runRetentionDays } from '../core/runs/run-data-purge.js';
 import { retryBaseDelayMs } from '../core/runs/policy.js';
 import { serverFileRepositoryManagerToken } from '@nocobase/app-plugin-file/server';
@@ -19,10 +25,12 @@ import { createAgents } from '../composition.js';
 import { createChatFileStorage } from '../core/conversations/index.js';
 import { directoryDisk } from '../core/skills/index.js';
 import { createAgentsSecretsStores } from '../secrets-stores.js';
+import { resolveAgentCli } from '../core/runs/index.js';
 import { runCredentialResolver } from '../cli/run-credential.js';
 import { bindCliSurface } from '../cli/surface.js';
 import { agentsSecurityFragment } from '../routes/openapi.js';
 import { agentsToken } from '../tokens.js';
+import { OnlineAgentCredentials, onlineAgentCredentialsToken, } from '../cli/online-credential.js';
 /** The first purge of chat files never sent waits this long after boot, then runs every `PURGE_INTERVAL_MS`. */
 const PURGE_DELAY_MS = 60_000;
 const PURGE_INTERVAL_MS = 60 * 60_000;
@@ -30,13 +38,62 @@ export class AgentsProvider extends ServiceProvider {
     name = ACCESS_NAMESPACE;
     releases = [];
     stoppingVectors;
+    surface;
+    /** Historical command surface, with execution-local authentication and cancellation. */
+    commandsOf(identity, token) {
+        const { container } = this.app;
+        const surface = this.surface;
+        if (!surface || !container.has(cliToken) || !container.has(apiDocsToken))
+            return Promise.resolve(undefined);
+        const cli = container.resolve(cliToken);
+        const base = this.app.publicBasePath.replace(/\/+$/u, '');
+        const config = this.app.config.get('agents');
+        const bin = resolveAgentCli(config?.cli, this.runApp(config)).name;
+        return (async () => {
+            const manifest = cli.manifestFor(await container.resolve(apiDocsToken).getDocument(), await surface.callerOf(identity));
+            return {
+                bin,
+                commands: manifest.commands,
+                send: async (request, signal) => {
+                    const path = base && request.path.startsWith(`${base}/`)
+                        ? request.path.slice(base.length)
+                        : request.path;
+                    return this.app.router.fetch(new Request(`http://application${path}`, {
+                        method: request.method,
+                        headers: {
+                            [HEADERS.runToken]: token,
+                            accept: 'application/json',
+                            'x-nocobase-client': 'cli',
+                            ...(typeof request.body === 'string'
+                                ? { 'content-type': 'application/json' }
+                                : {}),
+                        },
+                        ...(request.body === undefined ? {} : { body: request.body }),
+                        signal,
+                    }));
+                },
+            };
+        })();
+    }
     register() {
         runRetentionDays(this.app.config.get('agents')?.runs?.retentionDays);
         retryBaseDelayMs(this.app.config.get('agents')?.runs?.retryBaseDelayMs);
+        this.app.container.singleton(onlineAgentCredentialsToken, () => new OnlineAgentCredentials());
         this.app.container.singleton(agentsToken, (resolver) => {
             const config = this.app.config.get('agents');
             return createAgents({
                 resolver,
+                sandbox: {
+                    bin: () => {
+                        const config = this.app.config.get('agents');
+                        return resolveAgentCli(config?.cli, this.runApp(config)).name;
+                    },
+                    cli: () => ({
+                        auth: resolver.resolve(authenticationToken),
+                        credentials: resolver.resolve(onlineAgentCredentialsToken),
+                        commandsOf: (identity, token) => this.commandsOf(identity, token),
+                    }),
+                },
                 retryBaseDelayMs: retryBaseDelayMs(config?.runs?.retryBaseDelayMs),
                 runRetentionDays: () => runRetentionDays(this.app.config.get('agents')?.runs?.retentionDays),
                 database: resolver.resolve(databaseManagerToken),
@@ -150,7 +207,7 @@ export class AgentsProvider extends ServiceProvider {
         if (!container.has(authenticationToken))
             return;
         const auth = container.resolve(authenticationToken);
-        this.releases.push(auth.addCredentialResolver(runCredentialResolver(services)));
+        this.releases.push(auth.addCredentialResolver(runCredentialResolver(services)), auth.addCredentialResolver(container.resolve(onlineAgentCredentialsToken).resolve));
         if (!container.has(cliToken) || !container.has(authorizationToken))
             return;
         const authorization = container.resolve(authorizationToken);
@@ -160,7 +217,11 @@ export class AgentsProvider extends ServiceProvider {
             authenticatePerson: every(auth.required({ scopedKeys: true }), authorization.middleware()),
             gate: services.gate,
         });
-        this.releases.push(() => surface.release());
+        this.surface = surface;
+        this.releases.push(() => {
+            surface.release();
+            this.surface = undefined;
+        });
     }
     async shutdown() {
         try {